CAS-004 Governance, Risk and Compliance Practice Test 3 — 15 Questions

Question 1

A multinational corporation is subject to GDPR and the California Consumer Privacy Act (CCPA). A security architect is designing a data governance solution to meet both regulations. Which TWO controls are most appropriate?

Accepted Answer

Implement data mapping to track personal data across systems and jurisdictions.. Options A and D are correct. GDPR and CCPA both require data mapping (A) to understand data flows, and data classification (D) to apply appropriate controls. Option B (retention schedule) is important but not the most critical for both regulations; retention is more GDPR-specific. Option C (DLP) is a technical control that supports compliance but is not a governance control. Option E (SIEM) is a security monitoring tool, not a governance control.

Answer

Deploy data loss prevention (DLP) technology to monitor data exfiltration.

Answer

Define a data retention schedule that automatically deletes data after a set period.

Answer

Integrate a security information and event management (SIEM) system for log analysis.

Question 2

A regional healthcare provider with 2,000 employees recently acquired a smaller clinic that uses a legacy electronic health record (EHR) system. The provider's security team performed a risk assessment and identified that the legacy system does not support encryption at rest, lacks role-based access controls (RBAC), and stores administrative credentials in plaintext. The system is scheduled to be decommissioned in 18 months, but it must remain operational to support patient care during the transition. The provider is subject to HIPAA and state breach notification laws. The CEO wants to avoid any disruption to patient services but also minimize regulatory risk. Which of the following is the BEST course of action?

Accepted Answer

Implement compensating controls such as network segmentation, storage-level encryption, and strict access monitoring.. Option D is the best course of action because it allows the legacy EHR system to remain operational for patient care while reducing regulatory risk. Compensating controls like network segmentation isolate the vulnerable system, storage-level encryption (e.g., BitLocker or LUKS) protects data at rest, and strict access monitoring (e.g., SIEM with real-time alerts) mitigates the lack of RBAC and plaintext credentials. This approach balances the CEO's requirement for no disruption with HIPAA's security rule requirements for reasonable safeguards.

Answer

Accelerate the migration timeline to replace the legacy system within 6 months.

Answer

Immediately disconnect the legacy system from the network and use manual processes.

Answer

Accept the residual risk and document it in the risk register.

Question 3

A global e-commerce company processes payment card data and is required to comply with PCI DSS. During a quarterly vulnerability scan, the security team discovers that a web application firewall (WAF) rule is blocking legitimate traffic, causing transaction failures. The WAF is a critical compensating control for a known vulnerability in the application that cannot be patched for 90 days. The compliance officer is concerned about maintaining PCI DSS compliance while ensuring business continuity. The security team proposes temporarily disabling the WAF to restore service while they fine-tune the rules. Which of the following is the BEST action?

Accepted Answer

Temporarily modify the WAF rule set to allow legitimate traffic while maintaining security, and schedule a permanent fix within 24 hours.. Option B is correct because fine-tuning the WAF rules quickly is the best approach to restore service while maintaining security. Option A is wrong because disabling the WAF would remove the compensating control and violate PCI DSS requirement 6.6. Option C is wrong because relying solely on network segmentation may not provide equivalent protection. Option D is wrong because accepting risk without a compensating control is not permitted under PCI DSS.

Answer

Segment the affected application from the rest of the network and remove the WAF from the data path.

Answer

Disable the WAF immediately to restore service and document the decision as a risk acceptance.

Answer

Accept the risk of transaction failures and keep the WAF in place until the rules are fully tested.

Question 4

A company is implementing a new cloud-based SaaS application and needs to ensure compliance with GDPR. The security team is tasked with updating the data protection impact assessment (DPIA). Which of the following should the team prioritize?

Accepted Answer

Assessing the types of personal data processed and the risks to data subjects. Under GDPR, a Data Protection Impact Assessment (DPIA) is mandatory when processing personal data that is likely to result in high risk to individuals. The core requirement is to systematically assess the types of personal data being processed, the necessity and proportionality of the processing, and the risks to data subjects' rights and freedoms. This directly aligns with option A, as the DPIA must identify and mitigate privacy risks before the SaaS application goes live.

Answer

Defining data retention schedules for all data types

Answer

Conducting a vulnerability scan of the SaaS application

Answer

Reviewing the cloud provider's SLA for uptime guarantees

Question 5

A security analyst discovers that an employee has been using a personal USB drive to transfer sensitive customer data from a workstation to a home computer. This violates the company's data handling policy. According to the company's incident response plan, which of the following is the FIRST step the analyst should take?

Accepted Answer

Isolate the workstation from the network. The first priority in any incident response is containment to prevent further data loss or network propagation. Isolating the workstation from the network (Option B) immediately stops the employee from exfiltrating additional data and prevents any potential lateral movement by malware that might be on the USB drive. This aligns with the NIST SP 800-61 incident response lifecycle, where containment precedes eradication and recovery.

Answer

Perform a forensic analysis of the workstation

Answer

Escalate the incident to the data protection officer (DPO)

Answer

Notify law enforcement

Question 6

A multinational organization is adopting a zero trust architecture and needs to align its network segmentation with regulatory requirements. The compliance team has identified that certain data must be isolated to meet PCI DSS scope reduction. Which of the following design approaches BEST supports both zero trust and PCI DSS compliance?

Accepted Answer

Implementing microsegmentation with software-defined networking. Microsegmentation with software-defined networking (SDN) enables granular, identity-aware isolation of workloads at the virtual network layer, which directly supports zero trust's 'never trust, always verify' principle by restricting lateral movement. For PCI DSS scope reduction, microsegmentation allows the organization to create a logical, auditable boundary around cardholder data environment (CDE) assets without relying on physical network topology, thereby reducing the scope of PCI DSS compliance assessments. This approach is superior because it provides dynamic, policy-driven segmentation that can adapt to regulatory changes while maintaining strict least-privilege access.

Answer

Deploying VLANs to separate cardholder data from other traffic

Answer

Using network access control (NAC) to enforce endpoint compliance

Answer

Placing all systems that process cardholder data in a DMZ

Question 7

A security manager is reviewing the company's vendor risk management program. Which of the following should be included as a mandatory step BEFORE entering into a contract with a new cloud service provider?

Accepted Answer

Conducting a third-party security assessment. Option C is correct because a third-party security assessment is a mandatory due diligence step before entering into a contract with a new cloud service provider. This assessment evaluates the vendor's security controls, compliance posture, and risk profile against the organization's requirements, ensuring that the vendor meets minimum security standards before any data or systems are entrusted to them. Without this pre-contract assessment, the organization would be accepting unknown risks that could lead to data breaches or compliance violations.

Answer

Establishing an incident response plan

Answer

Performing a penetration test of the vendor's infrastructure

Answer

Requesting monthly vulnerability reports

Question 8

During a compliance audit, an organization discovers that its backup data for a critical database is stored in an unencrypted format on a tape that is kept offsite. The organization's data protection policy requires encryption of all data at rest. Which of the following is the BEST remediation action?

Accepted Answer

Re-encrypt the existing tape and implement encryption for all future backups. Option C is the best remediation because it directly addresses the compliance violation by re-encrypting the existing unencrypted tape and ensuring all future backups are encrypted before being written to tape. This aligns with the data protection policy requiring encryption of data at rest, as the tape is a storage medium that holds data at rest. Simply encrypting future backups (Option D) would leave the existing unencrypted data in violation, while the other options do not address the at-rest encryption requirement.

Answer

Change the offsite storage provider to one with better physical security

Answer

Implement TLS for data transmission to offsite storage

Answer

Encrypt all future backups before writing to tape

Question 9

A company is merging with another organization and needs to integrate their identity management systems. The security team is concerned about maintaining least privilege and segregation of duties across the combined environment. Which of the following approaches BEST addresses these concerns?

Accepted Answer

Perform a role-mining exercise and design new roles based on common job functions. Option D is correct because role-mining analyzes existing user entitlements and access patterns across both organizations to identify common job functions, enabling the design of least-privilege roles that enforce segregation of duties. This approach directly addresses the security concerns by ensuring users receive only the permissions necessary for their roles, preventing conflicts of interest inherent in merged environments.

Answer

Deploy single sign-on (SSO) across both organizations

Answer

Create a unified user group with the same permissions for all employees

Answer

Use an identity governance and administration (IGA) tool with automated provisioning

Question 10

A security team is developing a data classification policy. Which TWO of the following elements should be included in the policy to ensure effective data governance?

Accepted Answer

Handling requirements for each classification level, including storage and transmission. Option A is correct because a data classification policy must define handling requirements for each classification level, specifying how data should be stored, transmitted, and accessed. This ensures consistent protection controls are applied based on sensitivity, which is a core governance principle. Without these requirements, data may be mishandled, leading to compliance violations or data breaches.

Answer

Data retention and disposal schedules

Answer

Encryption algorithms to be used for data at rest

Answer

Data loss prevention (DLP) rules

Question 11

Drag and drop the steps to deploy a new certificate from an internal CA using Group Policy into the correct order.

Question 12

Drag and drop the steps to perform a vulnerability scan using Nessus into the correct order.

Question 13

Match each port number to its associated protocol.

Question 14

Match each encryption standard or algorithm to its type.

Question 15

A company is implementing a new vendor risk management program. Which of the following is the BEST approach to assess third-party security controls?

Accepted Answer

Use a standardized security questionnaire and conduct on-site audits. Option C is correct because a standardized questionnaire and on-site audits provide a comprehensive assessment of vendor security practices. Option A is wrong because relying solely on vendor self-assessments may be biased and incomplete. Option B is wrong because financial stability does not guarantee security. Option D is wrong because checking only public breaches is reactive and insufficient.

Answer

Check the vendor’s financial stability

Answer

Rely on the vendor’s self-assessment questionnaire

Answer

Review only public breach reports about the vendor